Cross-site scripting (XSS) vulnerability in the errorAction method in the ActionController base class in the Extbase Framework in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6, when the Rewritten Property Mapper is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified input, which is returned in an error message. NOTE: this might be the same vulnerability as CVE-2013-7072.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Cross-site scripting (XSS) vulnerability in the errorAction method in the ActionController base class in
    the Extbase Framework in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0
    through 6.1.6, when the Rewritten Property Mapper is enabled, allows remote attackers to inject arbitrary
    web script or HTML via unspecified input, which is returned in an error message. NOTE: this might be the
    same vulnerability as CVE-2013-7072. (CVE-2013-7078)

Several vulnerabilities were discovered in TYPO3, a content management system. This update addresses cross-site scripting, information disclosure, mass assignment, open redirection and insecure unserialize vulnerabilities and corresponds to TYPO3-CORE-SA-2013-004.

ID	Name	Product	Family	Severity
433134	SCA: security update for typo3/cms-core (GHSA-qj69-chjp-g4f5)	Tenable Cloud Security	SCA Checks	medium
433134	SCA: security update for typo3/cms-core (GHSA-qj69-chjp-g4f5)	Tenable Self-Hosted Container Security	SCA Checks	medium
71782	Debian DSA-2834-1 : typo3-src - several vulnerabilities	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2013-7078

medium

Tenable Plugins

medium

medium

medium